Table of Contents Link to heading

• AAA: Authentication, Authorisation, and Accounting
• RADIUS: Network Access Authentication
• TACACS+: Device Administration
• RADIUS vs TACACS+: Choosing the Right Protocol
• Configuration
  • Enable AAA
  • Local AAA Fallback
  • RADIUS Configuration for Network Access
  • TACACS+ Configuration for Device Administration
  • Apply AAA to Lines
  • Enterprise Configuration Template
  • Verification

AAA: Authentication, Authorisation, and Accounting Link to heading

AAA is the framework that controls who can access network devices, what they can do once connected, and what they did during the session.

When AAA is enabled on a Cisco device (aaa new-model), the device stops using line-level passwords entirely and routes all login attempts through the configured AAA method list. The method list defines an ordered sequence of authentication sources — typically an external server first, with local accounts as fallback.

RADIUS: Network Access Authentication Link to heading

RADIUS (Remote Authentication Dial-In User Service) was designed for authenticating end users connecting to the network — not for managing network devices themselves.

Primary use cases:

• 802.1X wired and wireless authentication — the standard protocol for EAP-based NAC
• VPN remote access — authenticates users connecting via IPsec or SSL VPN
• Web authentication portals — guest and BYOD onboarding

RADIUS encrypts only the password field in the authentication packet. All other attributes — including the username — are transmitted in cleartext, which is acceptable for end-user access but inappropriate for device administration sessions where command sequences are sensitive.

TACACS+: Device Administration Link to heading

TACACS+ (Terminal Access Controller Access-Control System Plus) is a Cisco-proprietary protocol designed specifically for managing access to network device CLIs.

Primary use cases:

• SSH and console login to routers, switches, and firewalls
• Privilege-level control — control which privilege level a user lands in after authentication
• Per-command authorisation — the defining capability of TACACS+, allowing the AAA server to approve or deny individual IOS commands before they execute

Unlike RADIUS, TACACS+ encrypts the entire payload of every packet — not just the password. This matters in device administration contexts where the commands being authorised are themselves sensitive.

RADIUS vs TACACS+: Choosing the Right Protocol Link to heading

Configuration Link to heading

Enable AAA Link to heading

conf t
aaa new-model

aaa new-model is a global command that immediately disables all line-level passwords and activates the AAA framework. Apply this before configuring servers or method lists — the order matters.

Local AAA Fallback Link to heading

Used as emergency fallback when external servers are unreachable, and for console access in environments where TACACS+ is not applied to the console line.

username admin privilege 15 secret Cisco123

aaa authentication login default local

line vty 0 4
 login authentication default
 transport input ssh

RADIUS Configuration for Network Access Link to heading

Used for 802.1X, VPN authentication, and end-user network access.

Define the RADIUS server:

radius server ISE
 address ipv4 10.10.10.10 auth-port 1812 acct-port 1813
 key radiuskey

Create a server group:

aaa group server radius ISE-GROUP
 server name ISE

Configure authentication method list:

aaa authentication login default group ISE-GROUP local

This translates to: try RADIUS first → if the server is unreachable, fall back to local accounts. A RADIUS reject (wrong password) does not trigger fallback — fallback only occurs on server timeout or unreachability.

Enable accounting:

aaa accounting exec default start-stop group ISE-GROUP

TACACS+ Configuration for Device Administration Link to heading

Used for SSH/console login to network devices, with per-command authorisation.

Define the TACACS+ server:

tacacs server ISE_TACACS
 address ipv4 10.10.10.10
 key tacacskey

Create a server group:

aaa group server tacacs+ TAC-GROUP
 server name ISE_TACACS

Configure authentication:

aaa authentication login default group TAC-GROUP local

Configure exec and command authorisation:

aaa authorization exec default group TAC-GROUP local
aaa authorization commands 15 default group TAC-GROUP local

Per-command authorisation (commands 15) sends every privilege-15 command to TACACS+ for approval before execution. This is the mechanism that allows ISE to enforce command-level RBAC — for example, permitting show commands but denying no shutdown for a read-only operator account.

Enable accounting:

aaa accounting commands 15 default start-stop group TAC-GROUP
aaa accounting exec default start-stop group TAC-GROUP

Command accounting records every command executed at privilege level 15 to the TACACS+ server, creating a complete audit trail of administrator activity.

Apply AAA to Lines Link to heading

line vty 0 4
 login authentication default
 authorization exec default
 transport input ssh

Enterprise Configuration Template Link to heading

aaa new-model

tacacs server ISE_TACACS
 address ipv4 10.10.10.10
 key tacacskey

aaa group server tacacs+ TAC-GROUP
 server name ISE_TACACS

aaa authentication login default group TAC-GROUP local
aaa authorization exec default group TAC-GROUP local
aaa authorization commands 15 default group TAC-GROUP local
aaa accounting exec default start-stop group TAC-GROUP
aaa accounting commands 15 default start-stop group TAC-GROUP

username backup privilege 15 secret Backup123

line vty 0 4
 login authentication default
 authorization exec default
 transport input ssh

Verification Link to heading

show aaa servers
show run | section aaa
show tacacs
show radius
debug tacacs
debug radius

show aaa servers shows request/response counters per server — a quick way to confirm the device is successfully reaching the AAA server and receiving responses. Rising error counters or zero responses indicate a connectivity or shared-secret mismatch.